# Flash Player vulnerabilities

> Flash Player is made by Adobe. We track 1,084 published vulnerabilities listed under that exact name, across 435 versions. 36 of them are on the list of flaws known to be exploited, the newest added on 17 September 2024. Adobe lists newer releases under their own names, such as Flash Player Desktop Runtime, so check those pages too.

Canonical page: https://www.precursorintelligence.com/product/adobe/flash_player

## At a glance

- **Made by:** [Adobe](https://www.precursorintelligence.com/vendors/adobe)
- **Published vulnerabilities:** 1,084
- **Known to be exploited:** 36 (listed under the name Flash Player)
- **Versions tracked:** 435
- **Most recently added to the known-exploited list:** [CVE-2013-0648](https://www.precursorintelligence.com/what-is/cve-2013-0648), 17 September 2024. We keep watching the list.

## Is Flash Player listed under other names?

Adobe also lists Flash Player under more specific names, such as Flash Player Desktop Runtime and Flash Player for Android. Flaws listed only under those names are counted on their own pages, not here.

- [Flash Player Desktop Runtime](https://www.precursorintelligence.com/product/adobe/flash_player_desktop_runtime): 294 published vulnerabilities
- [Flash Player for Android](https://www.precursorintelligence.com/product/adobe/flash_player_for_android): 35 published vulnerabilities
- [Flash Player for Linux](https://www.precursorintelligence.com/product/adobe/flash_player_for_linux): 21 published vulnerabilities
- [Flash Player Extended Support Release](https://www.precursorintelligence.com/product/adobe/flash_player_extended_support_release): 1 published vulnerability
- [Flash Player Installer](https://www.precursorintelligence.com/product/adobe/flash_player_installer): 1 published vulnerability

## Which versions of Flash Player do the exploited flaws hit?

Each exploited flaw lists the versions it affects, as published. "before 10.3.183.67" means every version up to, but not including, 10.3.183.67.

- [CVE-2013-0648](https://www.precursorintelligence.com/what-is/cve-2013-0648) (Adobe Flash Player Code Execution Vulnerability): before 10.3.183.67, 11.0 to before 11.6.602.171
- [CVE-2014-0497](https://www.precursorintelligence.com/what-is/cve-2014-0497) (Adobe Flash Player Integer Underflow Vulnerablity): before 11.2.202.336, before 11.7.700.261, 11.8.800.94 to before 12.0.0.44
- [CVE-2014-0502](https://www.precursorintelligence.com/what-is/cve-2014-0502) (Adobe Flash Player Double Free Vulnerablity): before 11.7.700.269, before 11.2.202.341, 11.8.800.94 to before 12.0.0.70
- [CVE-2013-0643](https://www.precursorintelligence.com/what-is/cve-2013-0643) (Adobe Flash Player Incorrect Default Permissions Vulnerability): before 10.3.183.67, 11.0 to before 11.6.602.171
- [CVE-2012-0754](https://www.precursorintelligence.com/what-is/cve-2012-0754) (Adobe Flash Player Memory Corruption Vulnerability): before 10.3.183.15, before 11.1.111.6, before 11.1.115.6, 11.0 to before 11.1.102.62
- [CVE-2012-0767](https://www.precursorintelligence.com/what-is/cve-2012-0767) (Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability): before 10.3.183.15, before 11.1.111.6, before 11.1.115.6, 11.0 to before 11.1.102.62
- [CVE-2010-1297](https://www.precursorintelligence.com/what-is/cve-2010-1297) (Adobe Flash Player Memory Corruption Vulnerability): before 9.0.277.0, 10.0 to before 10.1.53.64
- [CVE-2011-0609](https://www.precursorintelligence.com/what-is/cve-2011-0609) (Adobe Flash Player Unspecified Vulnerability): up to 10.2.154.13, up to 10.1.106.16
- [CVE-2012-5054](https://www.precursorintelligence.com/what-is/cve-2012-5054) (Adobe Flash Player Integer Overflow Vulnerability): before 11.4.402.265
- [CVE-2009-1862](https://www.precursorintelligence.com/what-is/cve-2009-1862) (Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability): 9.0 to 9.0.159.0, 10.0 to 10.0.22.87
- [CVE-2015-8651](https://www.precursorintelligence.com/what-is/cve-2015-8651) (Adobe Flash Player Integer Overflow Vulnerability): before 11.2.202.559, before 18.0.0.324, 19.0.0.185 to before 20.0.0.267
- [CVE-2016-1010](https://www.precursorintelligence.com/what-is/cve-2016-1010) (Adobe Flash Player and AIR Integer Overflow Vulnerability): up to 20.0.0.306, up to 11.2.202.569
- [CVE-2016-0984](https://www.precursorintelligence.com/what-is/cve-2016-0984) (Adobe Flash Player and AIR Use-After-Free Vulnerability): up to 11.2.202.559, up to 18.0.0.326, up to 20.0.0.272, up to 20.0.0.286
- [CVE-2014-8439](https://www.precursorintelligence.com/what-is/cve-2014-8439) (Adobe Flash Player Dereferenced Pointer Vulnerability): up to 11.2.202.418, up to 15.0.0.223, up to 13.0.0.252
- [CVE-2015-0310](https://www.precursorintelligence.com/what-is/cve-2015-0310) (Adobe Flash Player ASLR Bypass Vulnerability): before 11.2.202.438, before 13.0.0.262, 14.0 to before 16.0.0.287
- [CVE-2018-5002](https://www.precursorintelligence.com/what-is/cve-2018-5002) (Adobe Flash Player Stack-based Buffer Overflow Vulnerability): up to 29.0.0.171
- [CVE-2014-9163](https://www.precursorintelligence.com/what-is/cve-2014-9163) (Adobe Flash Player Stack-Based Buffer Overflow Vulnerability): 11.0 to before 11.2.202.425, 13.0 to before 13.0.0.259, 14.0 to 14.0.0.179, 15.0 to before 15.0.0.246
- [CVE-2015-0313](https://www.precursorintelligence.com/what-is/cve-2015-0313) (Adobe Flash Player Use-After-Free Vulnerability): before 11.2.202.442, before 13.0.0.269, 14.0.0.125 to before 16.0.0.305
- [CVE-2015-5122](https://www.precursorintelligence.com/what-is/cve-2015-5122) (Adobe Flash Player Use-After-Free Vulnerability): 11.0 to 11.2.202.481, 13.0 to 13.0.0.302, 18.0 to 18.0.0.204
- [CVE-2015-5123](https://www.precursorintelligence.com/what-is/cve-2015-5123) (Adobe Flash Player Use-After-Free Vulnerability): 11.0 to 11.2.202.481, 13.0 to 13.0.0.302, 18.0 to 18.0.0.203
- [CVE-2015-0311](https://www.precursorintelligence.com/what-is/cve-2015-0311) (Adobe Flash Player Remote Code Execution Vulnerability): up to 11.2.202.438, up to 13.0.0.262, 14.0.0.125 to before 16.0.0.287
- [CVE-2015-3113](https://www.precursorintelligence.com/what-is/cve-2015-3113) (Adobe Flash Player Heap-Based Buffer Overflow Vulnerability): before 13.0.0.296, before 11.2.202.468, 14.0.0.125 to before 18.0.0.194
- [CVE-2012-2034](https://www.precursorintelligence.com/what-is/cve-2012-2034) (Adobe Flash Player Memory Corruption Vulnerability): up to 11.2.202.235, up to 11.1.115.8, up to 11.1.111.9
- [CVE-2016-7892](https://www.precursorintelligence.com/what-is/cve-2016-7892) (Adobe Flash Player Use-After-Free Vulnerability): up to 23.0.0.207, up to 11.2.202.644
- [CVE-2016-4171](https://www.precursorintelligence.com/what-is/cve-2016-4171) (Adobe Flash Player Remote Code Execution Vulnerability): up to 11.2.202.621, up to 21.0.0.242, up to 18.0.0.352
- [CVE-2011-0611](https://www.precursorintelligence.com/what-is/cve-2011-0611) (Adobe Flash Player Remote Code Execution Vulnerability): before 10.2.154.27, up to 10.2.156.12
- [CVE-2015-3043](https://www.precursorintelligence.com/what-is/cve-2015-3043) (Adobe Flash Player Memory Corruption Vulnerability): before 11.2.202.457, before 13.0.0.281, 14.0.0.125 to before 17.0.0.169
- [CVE-2015-5119](https://www.precursorintelligence.com/what-is/cve-2015-5119) (Adobe Flash Player Use-After-Free Vulnerability): up to 11.2.202.468, 13.0.0.182 to 13.0.0296, 14.0.0.125 to 18.0.0.194
- [CVE-2015-7645](https://www.precursorintelligence.com/what-is/cve-2015-7645) (Adobe Flash Player Arbitrary Code Execution Vulnerability): up to 11.2.202.535, 18.0.0.160 to 18.0.0.252, 19.0.0.185, 19.0.0.207
- [CVE-2012-1535](https://www.precursorintelligence.com/what-is/cve-2012-1535) (Adobe Flash Player Arbitrary Code Execution Vulnerability): before 11.3.300.271, before 11.2.202.238

Checked: the 30 most recently added of 36 exploited flaws.

## Which Flash Player vulnerabilities are being exploited?

36 flaws are on the government list of vulnerabilities known to be exploited, newest first:

- [CVE-2013-0648](https://www.precursorintelligence.com/what-is/cve-2013-0648): Adobe Flash Player Code Execution Vulnerability. High, CVSS 8.8, chance of use in 30 days 11%, known exploited since 17 September 2024.
- [CVE-2014-0497](https://www.precursorintelligence.com/what-is/cve-2014-0497): Adobe Flash Player Integer Underflow Vulnerablity. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 17 September 2024.
- [CVE-2014-0502](https://www.precursorintelligence.com/what-is/cve-2014-0502): Adobe Flash Player Double Free Vulnerablity. High, CVSS 8.8, chance of use in 30 days 25%, known exploited since 17 September 2024.
- [CVE-2013-0643](https://www.precursorintelligence.com/what-is/cve-2013-0643): Adobe Flash Player Incorrect Default Permissions Vulnerability. High, CVSS 8.8, chance of use in 30 days 11%, known exploited since 17 September 2024.
- [CVE-2012-0754](https://www.precursorintelligence.com/what-is/cve-2012-0754): Adobe Flash Player Memory Corruption Vulnerability. High, CVSS 8.1, chance of use in 30 days 91%, known exploited since 8 June 2022.
- [CVE-2012-0767](https://www.precursorintelligence.com/what-is/cve-2012-0767): Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability. Medium, CVSS 6.1, chance of use in 30 days 6.2%, known exploited since 8 June 2022.
- [CVE-2010-1297](https://www.precursorintelligence.com/what-is/cve-2010-1297): Adobe Flash Player Memory Corruption Vulnerability. High, CVSS 7.8, chance of use in 30 days 83%, known exploited since 8 June 2022.
- [CVE-2011-0609](https://www.precursorintelligence.com/what-is/cve-2011-0609): Adobe Flash Player Unspecified Vulnerability. High, CVSS 7.8, chance of use in 30 days 64%, known exploited since 8 June 2022.
- [CVE-2012-5054](https://www.precursorintelligence.com/what-is/cve-2012-5054): Adobe Flash Player Integer Overflow Vulnerability. High, CVSS 8.8, chance of use in 30 days 21%, known exploited since 8 June 2022.
- [CVE-2009-1862](https://www.precursorintelligence.com/what-is/cve-2009-1862): Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability. High, CVSS 7.8, chance of use in 30 days 21%, known exploited since 8 June 2022.
- [CVE-2015-8651](https://www.precursorintelligence.com/what-is/cve-2015-8651): Adobe Flash Player Integer Overflow Vulnerability. High, CVSS 8.8, chance of use in 30 days 68%, known exploited since 25 May 2022.
- [CVE-2016-1010](https://www.precursorintelligence.com/what-is/cve-2016-1010): Adobe Flash Player and AIR Integer Overflow Vulnerability. High, CVSS 8.8, chance of use in 30 days 19%, known exploited since 25 May 2022.
- [CVE-2016-0984](https://www.precursorintelligence.com/what-is/cve-2016-0984): Adobe Flash Player and AIR Use-After-Free Vulnerability. High, CVSS 8.8, chance of use in 30 days 55%, known exploited since 25 May 2022.
- [CVE-2014-8439](https://www.precursorintelligence.com/what-is/cve-2014-8439): Adobe Flash Player Dereferenced Pointer Vulnerability. High, CVSS 8.8, chance of use in 30 days 20%, known exploited since 25 May 2022.
- [CVE-2015-0310](https://www.precursorintelligence.com/what-is/cve-2015-0310): Adobe Flash Player ASLR Bypass Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 15%, known exploited since 25 May 2022.
- [CVE-2018-5002](https://www.precursorintelligence.com/what-is/cve-2018-5002): Adobe Flash Player Stack-based Buffer Overflow Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 25%, known exploited since 23 May 2022.
- [CVE-2014-9163](https://www.precursorintelligence.com/what-is/cve-2014-9163): Adobe Flash Player Stack-Based Buffer Overflow Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 21%, known exploited since 13 April 2022.
- [CVE-2015-0313](https://www.precursorintelligence.com/what-is/cve-2015-0313): Adobe Flash Player Use-After-Free Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 95%, known exploited since 13 April 2022.
- [CVE-2015-5122](https://www.precursorintelligence.com/what-is/cve-2015-5122): Adobe Flash Player Use-After-Free Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 94%, known exploited since 13 April 2022.
- [CVE-2015-5123](https://www.precursorintelligence.com/what-is/cve-2015-5123): Adobe Flash Player Use-After-Free Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 19%, known exploited since 13 April 2022.
- [CVE-2015-0311](https://www.precursorintelligence.com/what-is/cve-2015-0311): Adobe Flash Player Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 86%, known exploited since 13 April 2022.
- [CVE-2015-3113](https://www.precursorintelligence.com/what-is/cve-2015-3113): Adobe Flash Player Heap-Based Buffer Overflow Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 13 April 2022.
- [CVE-2012-2034](https://www.precursorintelligence.com/what-is/cve-2012-2034): Adobe Flash Player Memory Corruption Vulnerability. High, CVSS 7.5, chance of use in 30 days 7.7%, known exploited since 28 March 2022.
- [CVE-2016-7892](https://www.precursorintelligence.com/what-is/cve-2016-7892): Adobe Flash Player Use-After-Free Vulnerability. High, CVSS 8.8, chance of use in 30 days 19%, known exploited since 25 March 2022.
- [CVE-2016-4171](https://www.precursorintelligence.com/what-is/cve-2016-4171): Adobe Flash Player Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 20%, known exploited since 25 March 2022.
- [CVE-2011-0611](https://www.precursorintelligence.com/what-is/cve-2011-0611): Adobe Flash Player Remote Code Execution Vulnerability. High, CVSS 8.8, chance of use in 30 days >99%, known exploited since 3 March 2022.
- [CVE-2015-3043](https://www.precursorintelligence.com/what-is/cve-2015-3043): Adobe Flash Player Memory Corruption Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 74%, known exploited since 3 March 2022.
- [CVE-2015-5119](https://www.precursorintelligence.com/what-is/cve-2015-5119): Adobe Flash Player Use-After-Free Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 March 2022.
- [CVE-2015-7645](https://www.precursorintelligence.com/what-is/cve-2015-7645): Adobe Flash Player Arbitrary Code Execution Vulnerability. High, CVSS 7.8, chance of use in 30 days 65%, known exploited since 3 March 2022.
- [CVE-2012-1535](https://www.precursorintelligence.com/what-is/cve-2012-1535): Adobe Flash Player Arbitrary Code Execution Vulnerability. High, CVSS 7.8, chance of use in 30 days 70%, known exploited since 3 March 2022.
- [CVE-2016-1019](https://www.precursorintelligence.com/what-is/cve-2016-1019): Adobe Flash Player Arbitrary Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 22%, known exploited since 3 March 2022.
- [CVE-2016-4117](https://www.precursorintelligence.com/what-is/cve-2016-4117): Adobe Flash Player Arbitrary Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 94%, known exploited since 3 March 2022.
- [CVE-2016-7855](https://www.precursorintelligence.com/what-is/cve-2016-7855): Adobe Flash Player Use-After-Free Vulnerability. High, CVSS 8.8, chance of use in 30 days 25%, known exploited since 3 March 2022.
- [CVE-2017-11292](https://www.precursorintelligence.com/what-is/cve-2017-11292): Adobe Flash Player Type Confusion Vulnerability. High, CVSS 8.8, chance of use in 30 days 12%, known exploited since 3 March 2022.
- [CVE-2018-15982](https://www.precursorintelligence.com/what-is/cve-2018-15982): Adobe Flash Player Use-After-Free Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 90%, known exploited since 15 February 2022.
- [CVE-2018-4878](https://www.precursorintelligence.com/what-is/cve-2018-4878): Adobe Flash Player Use-After-Free Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 90%, known exploited since 3 November 2021.

## Which Flash Player flaws are most likely to be used?

Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days):

- [CVE-2014-0497](https://www.precursorintelligence.com/what-is/cve-2014-0497): >99%, Critical (CVSS 9.8), known exploited
- [CVE-2015-3113](https://www.precursorintelligence.com/what-is/cve-2015-3113): >99%, Critical (CVSS 9.8), known exploited
- [CVE-2011-0611](https://www.precursorintelligence.com/what-is/cve-2011-0611): >99%, High (CVSS 8.8), known exploited
- [CVE-2015-0313](https://www.precursorintelligence.com/what-is/cve-2015-0313): 95%, Critical (CVSS 9.8), known exploited
- [CVE-2014-0515](https://www.precursorintelligence.com/what-is/cve-2014-0515): 94%, Critical (CVSS 10.0)
- [CVE-2016-4117](https://www.precursorintelligence.com/what-is/cve-2016-4117): 94%, Critical (CVSS 9.8), known exploited
- [CVE-2007-0071](https://www.precursorintelligence.com/what-is/cve-2007-0071): 93%, Critical (CVSS 9.3)
- [CVE-2015-0359](https://www.precursorintelligence.com/what-is/cve-2015-0359): 92%, Critical (CVSS 10.0)

## Questions

### How many vulnerabilities does Flash Player have?

We track 1,084 published vulnerabilities listed under the name Flash Player, across 435 versions. The most recent Flash Player flaw added to the known-exploited list is CVE-2013-0648, on 17 September 2024.

### Which Flash Player vulnerabilities are being exploited?

36 are on the list of flaws known to be exploited. The most recently added are CVE-2013-0648, CVE-2014-0497 and CVE-2014-0502.

### Why are newer Flash Player flaws missing from this page?

Adobe also lists Flash Player under more specific names, such as Flash Player Desktop Runtime and Flash Player for Android. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.

### Which versions of Flash Player do the exploited flaws affect?

Each flaw names its own versions, usually as ranges. The newest, CVE-2013-0648, affects before 10.3.183.67, 11.0 to before 11.6.602.171. The versions for every exploited flaw are listed on this page.

### How do I get alerts for Flash Player?

Create a Precursor Intelligence account and track Flash Player. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.

## Running Flash Player?

Precursor Intelligence keeps checking for you:

- **Tell us what you run.** Pick your software from a list, or let us work it out from your website.
- **We match it to every flaw.** Over 400,000 published flaws, checked against your list.
- **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it.
- **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools.

Start free (no card, nothing to install): https://www.precursorintelligence.com/register
Book a demo: https://www.precursorintelligence.com/contact